> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AgentSight

> Observe what AI agents actually do on your hosts — the processes they spawn, the calls they make and the files they touch — from the kernel.

An AI agent that can run commands, edit files and call APIs is a workload with
unusually broad reach and unusually little instrumentation. AgentSight observes
that behaviour from the kernel, using eBPF, rather than trusting the agent to
report on itself.

<Info>
  **AgentSight is a plan feature and requires its own agent installed on the
  hosts running your AI workloads.** Talk to your account contact about
  enabling it.
</Info>

## What it shows

| View         | Answers                                                                   |
| :----------- | :------------------------------------------------------------------------ |
| **Agents**   | Which AI agents have been observed, and when                              |
| **Events**   | Individual observed actions                                               |
| **Timeline** | What happened in what order — the sequence, which is usually the question |
| **Summary**  | Aggregate activity over a window                                          |
| **Insights** | Derived observations across the activity                                  |

## Why kernel-level

<Note>
  **An agent's own logs describe what it believes it did.** Kernel observation
  records what actually happened at the system boundary — the process that was
  spawned, the connection that was opened, the file that was read.

  For a component whose whole purpose is taking autonomous action, the
  difference between those two is the entire point of monitoring it.
</Note>

Because it observes from the kernel, it needs no cooperation from the agent
framework, works across frameworks, and cannot be disabled by the workload
being observed.

## Governance alerting

Alert rules of type **governance** evaluate policy conditions against AgentSight
data — so "an agent did something outside what we permit" becomes a
notification rather than something discovered later.

Governance rules run on the ordinary 60-second alerting loop. See
[Alerting](/guides/alerts/overview).

## Retention

Raw events are kept for **30 days**; rolled-up aggregates for **90 days**. Same
shape as the rest of the platform — recent detail, longer-lived trends.

## What it is not

<Warning>
  **AgentSight is not the zero-code instrumentation agent.** They are separate
  products with separate purposes: AgentSight observes AI-agent behaviour for
  governance; [zero-code instrumentation](/zero-code/overview) produces
  application traces and RED metrics for services generally.

  **Both attach probes to the same TLS library symbols, and running both on one
  host is untested and not recommended.** If you are evaluating both, use
  separate hosts and talk to your account contact.
</Warning>

<Warning>
  **It observes behaviour, not intent.** It records that a process was spawned
  or a connection opened. Whether that was correct is a policy question, which
  is what governance rules are for — the data alone does not decide it.
</Warning>

## Next

<CardGroup cols={3}>
  <Card title="LLM observability" icon="robot" href="/guides/llm/overview">
    Cost, latency and errors for your model calls.
  </Card>

  <Card title="Alerting" icon="bell" href="/guides/alerts/overview">
    Governance rules and how the loop evaluates.
  </Card>

  <Card title="Security events" icon="shield-halved" href="/guides/security/overview">
    Detections, runtime threats and exposed secrets.
  </Card>
</CardGroup>